While there are many improvements to features like Declarative Device Management (DDM) and MDM, one of the most interesting to me only got a short mention with no details.
Automated Device Enrollment can be enforced after Setup Assistant.
This feature, which I’m calling Retroactive Automated Device Enrollment, was announced during WWDC and I extensively tested it during the beta cycles.
I think there is some amazing potential here. Read on for details…
Automated Device Enrollment (ADE) is the free Apple service which enables zero touch deployment. Using Apple Business Manager, devices can be assigned to MDM servers automatically or manually. Users will be forced to enroll during Setup Assistant if they are connected to the internet.
The ability to enforce this enrollment has gotten better each of the past few years.
macOS 12 Monterey and earlier
In earlier versions of macOS, end users could easily avoid Automated Device Enrollment. If they were not connected to the internet while going through Setup Assistant they could begin using the Mac without enrolling in MDM.
While macOS would prompt them to enroll later via Notification Center banners, these could easily be ignored indefinitely.
macOS 13 Ventura
Mac computers registered to an organization must connect to a network during Setup Assistant after being erased or reset.
Apple begin to close this gap last year in macOS Ventura.
Unfortunately this feature is not enabled when computers ship from the factory and only takes effect after the Mac has connected to the internet for the first time.
I’ll have a new post about how we workaround this limitation shortly and will add the link here…
macOS 14 Sonoma
Apple has taken another great step forward in macOS Sonoma. Instead of the small Notification Center banner, users now get a full screen dialog that can’t be ignored.
The “Not now” option can be used to defer the MDM enrollment, but only for eight hours. After that time expires the Mac is basically useless until the user complies.
When the new feature is first activated, users will see the above full screen dialog. If they click “Not now” it will disappear and not automatically reappear for eight hours.
During this time System Settings will have an update available notification. When users open System Settings they will see a notification to Enroll in Remote Management. Clicking the notification will open a small prompt.
Choosing Enroll launches the full screen dialog while selecting Later dismisses the dialog.
If the user has chosen to defer, macOS will prompt the user again after eight hours. However this time the “Not now” option is gone and the user must enroll to continue using the Mac.
- After clicking Enroll the user will need to authenticate as an administrator.
- If enabled on your MDM, the user will need to authenticate to continue enrollment.
- The enrollment profile will be installed.
- Enrollment will complete and the user can quit the full screen dialog and continue working.
Differences from Setup Assistant
Unlike ADE during Setup Assistant, only the enrollment profile will be installed before the user is returned to the desktop. This means they will be able to continue working while additional configuration profiles and apps are installed in the background.
This experience may not be what you expect and should be tested in your environment.
Users with an unmanaged computer that is assigned to an MDM in ABM are the most likely to see this new experience automatically.
Primarily these are users who accidentally or purposefully were not connected to the internet during setup in the past and have ignored the older style alerts.
This new dialog should be displayed about one hour after completing the upgrade to macOS Sonoma.
This is a change from the beta period when the dialog would be activate almost immediately.
Just as in past versions of macOS, the prompt to enroll can be triggered with either the
sudo profiles renew -type enrollment or
sudo profiles -N commands.
The user experience will be the same and the eight hour timer will start after execution.
These commands also provide the ability to trigger the full screen dialog additional times before the eight hour timer expires. The user will be able to select “Not now” on each of these additional triggers.
One place I see this being particularly useful is MDM migrations. Changing MDM servers has always been a huge undertaking. It requires every end user to take action and could potentially leave devices unmanaged.
However this process can be greatly simplified with the new Retroactive Automated Device Enrollment in macOS Sonoma.
Now users can be prompted with the native macOS dialog and then forced to enroll eight hours later. This can be accomplished with a script and LaunchDaemon and no need to ship a GUI application.
I’m looking forward to seeing how this new feature is put to use!
More testing needed
There are a few scenarios I haven’t had time to test yet:
- Automatic triggering after MDM assignment change and unenrollment
- With an MDM enrolled computer running macOS Sonoma;
- Change the MDM assignment in ABM;
- Unenroll the computer from the current MDM;
- Will macOS automatically prompt for re-enrollment based on the changed MDM assignment?
- Automatic triggering if the Mac was not assigned to MDM originally
- Un-assign the Mac from the MDM server in ABM;
- Clean install macOS Ventura and setup without ADE;
- Assign the Mac to an MDM server in ABM;
- Upgrade to macOS Sonoma;
- Will macOS automatically prompt for enrollment?
- Standard user experience
- Is there a way to leverage this new functionality with standard, non-admin, local users?
I’ll update this post when I have had a chance to test these. If you already have, please share your experiences in the comments.